Overview 868 matches · 82 in Waratek scope · 59 protected · 367 exploited · 247 CISA KEV · 632 public PoC
868matches
82in Waratek scope9.4%
59protected6.8%
367exploited42.3%
247CISA KEV28.5%
632public PoC72.8%
Protected by Waratek
63
7.3%
Rule in development
0
0.0%
Mitigation candidate
12
1.4%
No exploit published
7
0.8%
Outside Waratek scope
84
9.7%
Not applicable
702
80.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
59
6.8%
partly blocked
4
0.5%
not blocked
805
92.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
367
42.3%
Working exploit published
280
32.3%
Proof of concept only
39
4.5%
Forecast only
182
21.0%
No public exploit
0
0.0%
split by
peak 77 / year
19962
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
Forecast only1
19971
Not applicable1
Medium1
not blocked1
Working exploit published1
19981
Not applicable1
Medium1
not blocked1
Working exploit published1
19994
Not applicable4
High4
not blocked4
Working exploit published4
200012
Outside Waratek scope1
Not applicable11
High5
Medium5
Low2
not blocked12
Exploited1
Working exploit published10
Forecast only1
200111
Outside Waratek scope1
Not applicable10
High6
Medium5
not blocked11
Exploited3
Working exploit published6
Forecast only2
200223
No exploit published2
Outside Waratek scope2
Not applicable19
High17
Medium5
Low1
not blocked23
Exploited2
Working exploit published14
Forecast only7
200317
Outside Waratek scope1
Not applicable16
Critical1
High13
Medium2
Low1
not blocked17
Exploited4
Working exploit published13
200430
Outside Waratek scope1
Not applicable29
High19
Medium11
not blocked30
Exploited3
Working exploit published27
200527
Outside Waratek scope1
Not applicable26
High20
Medium7
not blocked27
Exploited2
Working exploit published21
Forecast only4
200632
Not applicable32
High24
Medium8
not blocked32
Exploited1
Working exploit published27
Forecast only4
200721
Outside Waratek scope1
Not applicable20
Critical2
High15
Medium4
not blocked21
Exploited6
Working exploit published13
Forecast only2
200822
Outside Waratek scope2
Not applicable20
Critical1
High18
Medium3
not blocked22
Exploited2
Working exploit published15
Forecast only5
200923
Outside Waratek scope1
Not applicable22
Critical1
High19
Medium2
Low1
not blocked23
Exploited11
Working exploit published11
Forecast only1
201022
Outside Waratek scope1
Not applicable21
High19
Medium3
not blocked22
Exploited4
Working exploit published12
Forecast only6
201118
Mitigation candidate1
Outside Waratek scope3
Not applicable14
Critical2
High9
Medium7
not blocked18
Exploited6
Working exploit published8
Proof of concept only1
Forecast only3
201219
Outside Waratek scope5
Not applicable14
Critical5
High10
Medium4
not blocked19
Exploited12
Working exploit published4
Proof of concept only2
Forecast only1
201321
Outside Waratek scope2
Not applicable19
Critical2
High16
Medium3
not blocked21
Exploited7
Working exploit published6
Forecast only8
201434
Mitigation candidate2
Outside Waratek scope3
Not applicable29
Critical6
High20
Medium7
Low1
not blocked34
Exploited20
Working exploit published9
Proof of concept only1
Forecast only4
201528
Protected by Waratek1
Outside Waratek scope2
Not applicable25
Critical7
High17
Medium2
Low2
blocked by ARMR today1
not blocked27
Exploited16
Working exploit published6
Proof of concept only1
Forecast only5
201645
Protected by Waratek5
Mitigation candidate1
No exploit published1
Outside Waratek scope3
Not applicable35
Critical9
High27
Medium8
Low1
blocked by ARMR today5
not blocked40
Exploited16
Working exploit published14
Proof of concept only1
Forecast only14
201750
Protected by Waratek10
Outside Waratek scope2
Not applicable38
Critical14
High34
Medium2
blocked by ARMR today8
partly blocked2
not blocked40
Exploited29
Working exploit published17
Forecast only4
201839
Protected by Waratek7
Outside Waratek scope8
Not applicable24
Critical11
High22
Medium6
blocked by ARMR today6
partly blocked1
not blocked32
Exploited20
Working exploit published9
Proof of concept only3
Forecast only7
201953
Protected by Waratek5
Mitigation candidate1
Outside Waratek scope12
Not applicable35
Critical16
High24
Medium13
blocked by ARMR today5
not blocked48
Exploited25
Working exploit published8
Proof of concept only2
Forecast only18
202054
Protected by Waratek10
Mitigation candidate2
No exploit published1
Outside Waratek scope10
Not applicable31
Critical20
High24
Medium10
blocked by ARMR today10
not blocked44
Exploited29
Working exploit published11
Proof of concept only2
Forecast only12
202177
Protected by Waratek10
No exploit published3
Outside Waratek scope16
Not applicable48
Critical24
High34
Medium19
blocked by ARMR today10
not blocked67
Exploited45
Working exploit published7
Proof of concept only3
Forecast only22
202251
Protected by Waratek6
Outside Waratek scope1
Not applicable44
Critical20
High26
Medium5
blocked by ARMR today6
not blocked45
Exploited23
Working exploit published2
Proof of concept only7
Forecast only19
202357
Protected by Waratek4
Mitigation candidate3
Outside Waratek scope3
Not applicable47
Critical17
High34
Medium6
blocked by ARMR today4
not blocked53
Exploited29
Proof of concept only6
Forecast only22
202440
Protected by Waratek3
Mitigation candidate1
Not applicable36
Critical13
High25
Medium2
blocked by ARMR today2
partly blocked1
not blocked37
Exploited20
Working exploit published3
Proof of concept only8
Forecast only9
202515
Protected by Waratek1
Mitigation candidate1
Not applicable13
Critical7
High4
Medium4
blocked by ARMR today1
not blocked14
Exploited13
Proof of concept only1
Forecast only1
202619
Protected by Waratek1
Outside Waratek scope2
Not applicable16
Critical11
High6
Medium2
blocked by ARMR today1
not blocked18
Exploited18
Proof of concept only1
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-111497 | Critical | 2026-10-22 | Outside Waratek scope | Exploited | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
| CVE-2026-110447 | Critical | 2026-10-14 | Not applicable | Exploited | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. |
| CVE-2026-21589 | Critical | 2026-10-05 | Not applicable | Exploited | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents. |
| CVE-2026-59310 | Critical | 2026-07-30 | Not applicable | Exploited | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code. |
| CVE-2026-55040 | Critical | 2026-07-14 | Not applicable | Exploited | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-49160 | High | 2026-06-09 | Not applicable | Proof of concept only | Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network. |
| CVE-2026-48710 | Medium | 2026-05-26 | Outside Waratek scope | Exploited | Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values. |
| CVE-2026-45659 | High | 2026-05-22 | Not applicable | Exploited | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| CVE-2026-34910 | Critical | 2026-05-22 | Not applicable | Exploited | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. |
| CVE-2026-34909 | Critical | 2026-05-22 | Not applicable | Exploited | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account. |
| CVE-2026-34908 | Critical | 2026-05-22 | Not applicable | Exploited | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system. |
| CVE-2026-42897 | High | 2026-05-14 | Not applicable | Exploited | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-41089 | Critical | 2026-05-12 | Not applicable | Exploited | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| CVE-2026-31431 | High | 2026-04-22 | Not applicable | Exploited | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. |
| CVE-2026-33824 | Critical | 2026-04-14 | Not applicable | Exploited | Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
| CVE-2026-32202 | Medium | 2026-04-14 | Not applicable | Exploited | Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-34486 | High | 2026-04-09 | Protected by Waratek | Exploited | Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue. |
| CVE-2026-21510 | High | 2026-02-10 | Not applicable | Exploited | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-21962 | Critical | 2026-01-20 | Not applicable | Exploited | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). |
| CVE-2025-58360 | Critical | 2025-11-25 | Protected by Waratek | Exploited | GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0. |
| CVE-2025-59287 | Critical | 2025-10-14 | Not applicable | Exploited | Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network. |
| CVE-2025-53771 | Medium | 2025-07-20 | Not applicable | Exploited | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-53770 | Critical | 2025-07-20 | Not applicable | Exploited | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation. |
| CVE-2025-47813 | Medium | 2025-07-10 | Not applicable | Exploited | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. |
| CVE-2025-47812 | Critical | 2025-07-10 | Not applicable | Exploited | In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts. |
| CVE-2025-49706 | Medium | 2025-07-08 | Not applicable | Exploited | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-49704 | High | 2025-07-08 | Not applicable | Exploited | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| CVE-2025-32463 | Critical | 2025-06-30 | Not applicable | Exploited | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
| CVE-2025-33073 | High | 2025-06-10 | Not applicable | Exploited | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-33053 | High | 2025-06-10 | Not applicable | Exploited | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
| CVE-2025-32969 | Critical | 2025-04-23 | Mitigation candidate | Exploited | XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki. |
| CVE-2025-24054 | Medium | 2025-03-11 | Not applicable | Exploited | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-21298 | Critical | 2025-01-14 | Not applicable | Proof of concept only | Windows OLE Remote Code Execution Vulnerability |
| CVE-2025-21285 | High | 2025-01-14 | Not applicable | Forecast only | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2024-43441 | Critical | 2024-12-24 | Mitigation candidate | Working exploit published | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue. |
| CVE-2024-49113 | High | 2024-12-12 | Not applicable | Proof of concept only | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability |
| CVE-2024-49112 | Critical | 2024-12-12 | Not applicable | Proof of concept only | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
| CVE-2024-43642 | High | 2024-11-12 | Not applicable | Forecast only | Windows SMB Denial of Service Vulnerability |
| CVE-2024-43451 | Medium | 2024-11-12 | Not applicable | Exploited | NTLM Hash Disclosure Spoofing Vulnerability |
| CVE-2024-43572 | High | 2024-10-08 | Not applicable | Exploited | Microsoft Management Console Remote Code Execution Vulnerability |
| CVE-2024-38812 | Critical | 2024-09-17 | Not applicable | Exploited | The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. |
| CVE-2024-43461 | High | 2024-09-10 | Not applicable | Exploited | Windows MSHTML Platform Spoofing Vulnerability |
| CVE-2024-38018 | High | 2024-09-10 | Not applicable | Forecast only | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2024-38063 | Critical | 2024-08-13 | Not applicable | Proof of concept only | Windows TCP/IP Remote Code Execution Vulnerability |
| CVE-2024-7399 | Critical | 2024-08-12 | Not applicable | Exploited | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. |
| CVE-2024-21182 | High | 2024-07-16 | Protected by Waratek | Exploited | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). |
| CVE-2024-38112 | High | 2024-07-09 | Not applicable | Exploited | Windows MSHTML Platform Spoofing Vulnerability |
| CVE-2024-38094 | High | 2024-07-09 | Not applicable | Exploited | Microsoft SharePoint Remote Code Execution Vulnerability |
| CVE-2024-38077 | Critical | 2024-07-09 | Not applicable | Proof of concept only | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
| CVE-2024-38030 | Medium | 2024-07-09 | Not applicable | Forecast only | Windows Themes Spoofing Vulnerability |
| CVE-2024-38023 | High | 2024-07-09 | Not applicable | Exploited | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2024-6387 | High | 2024-07-01 | Not applicable | Exploited | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. |
| CVE-2024-38475 | Critical | 2024-07-01 | Not applicable | Exploited | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. |
| CVE-2024-38472 | High | 2024-07-01 | Not applicable | Working exploit published | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing. |
| CVE-2024-36401 | Critical | 2024-07-01 | Protected by Waratek | Exploited | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed. |
| CVE-2024-30088 | High | 2024-06-11 | Not applicable | Exploited | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2024-23692 | Critical | 2024-05-31 | Not applicable | Exploited | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported. |
| CVE-2024-4358 | Critical | 2024-05-29 | Not applicable | Exploited | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. |
| CVE-2024-21683 | High | 2024-05-21 | Not applicable | Exploited | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://confluence.atlassian.com/doc/confluence-release-notes-327.html You can download the latest version of Confluence Data Center and Server from the download center https://www.atlassian.com/software/confluence/download-archives. This vulnerability was found internally. |
| CVE-2024-30044 | High | 2024-05-14 | Not applicable | Forecast only | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2024-30043 | High | 2024-05-14 | Not applicable | Proof of concept only | Microsoft SharePoint Server Information Disclosure Vulnerability |
| CVE-2024-31309 | High | 2024-04-10 | Not applicable | Forecast only | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue. |
| CVE-2024-26256 | High | 2024-04-09 | Not applicable | Forecast only | Libarchive Remote Code Execution Vulnerability |
| CVE-2024-26212 | High | 2024-04-09 | Not applicable | Forecast only | DHCP Server Service Denial of Service Vulnerability |
| CVE-2024-27316 | High | 2024-04-04 | Not applicable | Proof of concept only | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. |
| CVE-2023-48788 | Critical | 2024-03-12 | Not applicable | Exploited | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets. |
| CVE-2024-20931 | High | 2024-02-17 | Protected by Waratek | Proof of concept only | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). |
| CVE-2023-50387 | High | 2024-02-14 | Not applicable | Proof of concept only | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. |
| CVE-2024-21412 | High | 2024-02-13 | Not applicable | Exploited | Internet Shortcut Files Security Feature Bypass Vulnerability |
| CVE-2024-21338 | High | 2024-02-13 | Not applicable | Exploited | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2024-0507 | High | 2024-01-16 | Not applicable | Forecast only | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program. |
| CVE-2024-0200 | Critical | 2024-01-16 | Not applicable | Working exploit published | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program. |
| CVE-2023-22527 | Critical | 2024-01-16 | Not applicable | Exploited | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin. |
| CVE-2024-20697 | High | 2024-01-09 | Not applicable | Forecast only | Windows libarchive Remote Code Execution Vulnerability |
| CVE-2023-48795 | Medium | 2023-12-18 | Outside Waratek scope | Exploited | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. |
| CVE-2023-35628 | High | 2023-12-12 | Not applicable | Forecast only | Windows MSHTML Platform Remote Code Execution Vulnerability |
| CVE-2023-36039 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36035 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36025 | High | 2023-11-14 | Not applicable | Exploited | Windows SmartScreen Security Feature Bypass Vulnerability |
| CVE-2023-46847 | High | 2023-11-03 | Not applicable | Forecast only | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. |
| CVE-2023-22518 | Critical | 2023-10-31 | Not applicable | Exploited | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. |
| CVE-2023-43795 | Critical | 2023-10-25 | Mitigation candidate | Exploited | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2. |
| CVE-2023-34048 | Critical | 2023-10-25 | Not applicable | Exploited | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution. |
| CVE-2023-43622 | High | 2023-10-23 | Not applicable | Proof of concept only | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue. |
| CVE-2023-38545 | Critical | 2023-10-18 | Outside Waratek scope | Proof of concept only | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. |
| CVE-2023-39456 | High | 2023-10-17 | Not applicable | Forecast only | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue. |
| CVE-2023-44487 | High | 2023-10-10 | Mitigation candidate | Exploited | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2023-41763 | Medium | 2023-10-10 | Not applicable | Exploited | Skype for Business Elevation of Privilege Vulnerability |
| CVE-2023-38171 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-36606 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
| CVE-2023-22515 | Critical | 2023-10-04 | Not applicable | Exploited | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue. |
| CVE-2023-4911 | High | 2023-10-03 | Not applicable | Exploited | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. |
| CVE-2023-40044 | Critical | 2023-09-27 | Not applicable | Exploited | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system. |
| CVE-2023-42442 | High | 2023-09-15 | Not applicable | Exploited | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`). |
| CVE-2023-38039 | High | 2023-09-15 | Not applicable | Proof of concept only | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. |
| CVE-2023-36777 | Medium | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2023-36745 | High | 2023-09-12 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36744 | High | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-2917 | Critical | 2023-08-17 | Not applicable | Forecast only | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message and potentially gain remote code execution abilities. |
| CVE-2023-2915 | Critical | 2023-08-17 | Not applicable | Forecast only | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unauthenticated remote threat actor can delete arbitrary files with system privileges. A malicious user could exploit this vulnerability by sending a specifically crafted synchronization protocol message resulting in a denial-of-service condition. |